search

d34dfr4m3 / prettycool

RedTeam/BugBounty Recon Tool
6 stars 1 forks source link

readme 

   +-----------------------------------------------------------------------------+
   |  [!] Legal disclaimer: Usage of this shit program for attacking targets     |
   |  without prior mutual consent is illegal.                                   |
   |  It is the end user's responsibility to obey all applicable local, state and|
   |  federal laws.                                                              |
   |  Developers assume no liability and are not responsible for any misuse or   |
   |  damage caused by this program                                              |
   +-----------------------------------------------------------------------------+

Passive Recon Tool

This tool use few API's to grab data from domains. Passive scan Active scan Search for relative data in AWS and Pastebin someday far way i will write a pretty cool readme, but not today guys

How it works?

I draw someshit here, it is outdated anyway, i will update after I finish some code stuff pipeline

Python3 Requirement

Required Programns

Instalation:

git clone https://github.com/d34dfr4m3/prettycool.git
cd prettyCool/install
sudo ./install.sh #and pray a while

Configuration(not required because I automate this shit):

Edit the file tools/report_maker.py and set the password: 

def createCon():
  connection = pymysql.connect(host='localhost',
                             user='prettycool',
                             password='',
                             db='db_data',
                             charset='utf8mb4',
                             cursorclass=pymysql.cursors.DictCursor)
  return connection

Edit the file tools/db_controler.py and set the password: 

def createCon():
  connection = pymysql.connect(host='localhost',
                             user='prettycool',
                             password='',
                             db='db_data',
                             charset='utf8mb4',
                             cursorclass=pymysql.cursors.DictCursor)
  return connection

database:

+-----------+--------------+
| cd_status | status_value |
+-----------+--------------+
|         1 | NOT STARTED  |
|         2 | STARTED      |
|         3 | FINISHED     |
|         4 | ERROR        |
|         5 | WAITING      |
|         6 | BURNED       |
|         7 | FINE         |
+-----------+--------------+
7 rows in set (0.001 sec)

Fluxo

  1. Input Domain
  2. Check the domain in db
  3. Start Host Discovery
    • Shodan
    • Censys (Returns: Ipaddress, Location,ASN, ASN ASN Name, ASN Description, ASN PREFIX, Service Port, Service Name, TCP Certificate)
    • CRT.SH (Returns: Hostname)
    • CertSpooter (Returns: Hostname)
    • VirusTotal (Returns: Hostname)
    • SecurityTrails (Returns: Hostname)
    • Spyse
    • DNSBuffer (Returns: Hostname, ipaddress)
  4. Check Enum from host db
  5. Host Enum
    • Censys
    • Shodan
  6. Check Service enum in DB
  7. Start Service enum
    • WayBackMachine

Data Sources:

Discovery (Footprint)

Proposal:

Sources

API Endpoints

Shodan (Check Features)

VirusTotal (Features ok)

Public API constraints and restrictions

The Public API is limited to 500 requests per day and a rate of 4 requests per minute.
The Public API must not be used in commercial products or services.
The Public API must not be used in business workflows that do not contribute new files.
You are not allowed to register multiple accounts to overcome the aforementioned limitations.

Endpoints

CertSpotter (Features ok)

DNSBuffer (Features ok)

SecurityTrails (Check Features)

Spyse (DOWN)

CRTSH

Intel

Proposal:

Sources

Enum (Fingerprint)

Proposal:

Sources

Tools for active recon

ToDO

Report

WayBackMachine

Maybe put in the project

Footprint DNS IP / Network
Web Recon
AWS S3 Bucket
#!/bin/bash
TARGET=$1
echo "[-] s3://$TARGET/"
aws --no-sign-request s3 cp data s3://$TARGET/
for S3_PATH in `aws --no-sign-request s3 ls s3://$TARGET`
do 
  if [[ ! $S3_PATH == "PRE" ]]
  then
    if [ $(echo $S3_PATH | grep '/' | wc -l) -eq 1 ];then
      echo "[-] s3://$TARGET/$S3_PATH"
      aws --no-sign-request s3 cp data s3://$TARGET/$S3_PATH
     fi
  fi
done
OSINT
Github

Usefull:

BugFix